Privacy Policy (DPDP)
Comprehensive disclosure of personal data processing, lawful bases, passenger rights, and governance standards under the Digital Personal Data Protection Act, 2023.
1. Who We Are & Governance
LayoverX (“LayoverX,” “we,” “us,” or “our”) operates an Indian transit-concierge and booking-facilitation platform via https://www.layoverx.in/. The platform is operated by [LEGAL ENTITY NAME], having its registered office at [REGISTERED ADDRESS].
LayoverX assists domestic and international transit passengers with stopovers around Chhatrapati Shivaji Maharaj International Airport, Terminal 2 (CSMIA T2), Mumbai, Maharashtra, India, by enabling them to discover, plan, bundle, and book micro-stay transit hotel pods, dining reservations, express wellness treatments, airport transfers, city excursions, gaming pods, and executive workspaces.
Primary Legal Framework:
This Privacy Policy is formulated primarily around the Digital Personal Data Protection Act, 2023 (DPDP Act) and the applicable rules and regulations made thereunder, including the Digital Personal Data Protection Rules, 2025 as applicable.
Where statutory provisions under the DPDP framework are subject to phased notification and staggered operationalization by the Central Government, LayoverX adheres to notified rules and continues to uphold established principles of fair information practices under applicable Indian law, including the Information Technology Act, 2000.
2. Information We Collect
We practice data minimization. LayoverX collects only personal data that is genuinely required to provide our itinerary planning engine, process concierge bookings, facilitate communication, and fulfill legal compliance:
Primary passenger full name, traveling companion names, age or date of birth (only where specifically necessitated by service-partner minimum age rules, such as hotel pod check-in or spa therapy restrictions), and nationality (only where necessary to confirm transit visa eligibility or airport zone clearance).
Email address for dispatching digital booking confirmations, vouchers, and invoice receipts; mobile phone number for urgent SMS updates; and WhatsApp number where you explicitly opt in to receive real-time concierge alerts, driver coordination, and gate status messages.
Inbound airline and flight number, arrival date and scheduled time, outbound airline and flight number, departure date and scheduled time, airport terminal details (CSMIA T2), total passenger count, and calculated layover duration. This data allows our engine to compute realistic activity schedules and buffer windows.
Unique LayoverX Booking ID, selected transit venues (hotel room pod tier, restaurant dining reservations, express spa treatments, chauffeur transfer routes, guided city excursions, or executive gaming stations), scheduled service time slots, guest special requests, and cancellation/refund records.
Transaction ID, payment gateway Order ID, payment status (successful, pending, failed), refund reference numbers, payment method chosen (e.g., UPI, credit/debit card, net banking), and encrypted token identifiers supplied by our authorized payment provider.
Internet Protocol (IP) address, browser type and version, device operating system, session identifier, security log timestamps, essential session cookies, and local browser storage (used strictly to cache your active itinerary drafts on your device).
When using the “My Itinerary” planning tool, we process your selected services, flight timings, transit buffer calculations, and saved draft parameters to organize your layover schedule.
Government Identity Documents:
LayoverX does NOT routinely collect, scan, upload, or store government identity documents (such as Aadhaar cards, Passports, PAN cards, Voter IDs, or Driving Licenses) through our website or standard booking flow.
Where an independent third-party provider (such as an airport transit hotel, chauffeur partner, or airport lounge) is mandated by Indian law, local police hotel guest registration rules (Form C for foreign nationals), or airport security (CISF) regulations to verify passenger identity, such physical inspection is conducted directly by the provider upon your arrival at the venue. If any specific service exceptionally requires advance identity submission, only strictly necessary information will be requested with explicit prior disclosure.
3. How We Use Your Information
We process your personal data strictly for defined, legitimate purposes connected to our transit-concierge services:
- Account & Session Management: Authenticating users, managing customer profiles, and preserving saved itinerary drafts.
- Itinerary Assembly & Feasibility: Calculating transit time windows, estimating buffer periods, and assembling realistic layover schedules.
- Booking Execution: Confirming reservations with independent hotel pod, restaurant, spa, transfer, and tour providers at or near CSMIA T2.
- Payment & Invoicing: Facilitating electronic payment verification, issuing official GST-compliant tax invoices, and processing eligible refunds.
- Voucher & Confirmation Issuance: Generating digital booking confirmations, e-vouchers, and QR access codes.
- Passenger Communications & Support: Delivering service reminders, chauffeur pickup directions, flight delay adjustments, and resolving support inquiries.
- Safety, Fraud Prevention & Platform Security: Detecting unauthorized transactions, preventing fraudulent reservations, verifying payment integrity, and protecting platform infrastructure.
- Statutory & Regulatory Compliance: Retaining mandatory accounting records, complying with tax regulations, responding to lawful governmental directives, and cooperating with consumer dispute bodies.
- Platform Enhancement: Evaluating user navigation flows, correcting technical bugs, and improving concierge reliability.
4. Consent & Your Rights Under the DPDP Framework
In accordance with the Digital Personal Data Protection Act, 2023, processing of personal data is carried out on lawful bases, primarily: (i) your informed, specific, unambiguous, and clear consent; (ii) the performance of a contract or steps necessary to fulfill your requested bookings; and (iii) compliance with legal obligations.
Your Statutory Rights as a Data Principal:
Withdrawal of Consent:
Where processing is based on your consent, you have the right to withdraw your consent at any time. You may exercise this right by submitting a written notice to our Privacy Desk at [PRIVACY EMAIL].
Please note that withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. Furthermore, if you withdraw consent for essential information (such as flight telemetry or contact details) required to execute a live booking, we may be unable to continue providing or coordinating the affected service, and standard cancellation conditions will apply.
5. Information Sharing & Third Parties
LayoverX shares personal data strictly on a need-to-know basis with trusted third parties to execute your transit arrangements:
- Third-Party Service Providers: Independent transit hotels, sleeping pod venues, restaurants, spas, chauffeur fleets, tour operators, and entertainment centers receive only the information necessary to fulfill your reservation (e.g., passenger name, service time, booking reference, and special requests).
- Payment Processors: Authorized, RBI-compliant payment gateway providers (such as Razorpay) process transaction amounts, order IDs, and payment authorizations.
- Cloud & Database Infrastructure: Secure cloud hosting, database management, and content delivery services that maintain our application infrastructure under strict confidentiality terms.
- Communications Dispatchers: Telecommunications, SMS, and messaging providers used to deliver digital booking confirmations, vouchers, and operational flight shift notifications.
- Legal & Law Enforcement Authorities: We may disclose information where required by court order, statutory regulation, lawful search warrant, or government agency directive, or where necessary to prevent fraud or protect the safety of passengers and the public.
Independent third-party service partners (such as hotel operators, transport drivers, and wellness clinics) act as independent data fiduciaries or controllers with respect to any information they directly obtain from you upon check-in or during service execution. Their handling of such information is governed by their own independent privacy notices and policies.
6. International Processing
Our core operations and concierge support desks are based in India. However, in operating a digital platform, certain enterprise technology vendors, cloud hosting providers, and communication networks may store or process data on servers located outside India.
Where cross-border processing occurs, LayoverX ensures that such transfers comply with all applicable requirements of the DPDP framework and Indian law, including ensuring that recipient vendors maintain adequate data security, contractual confidentiality, and organizational safeguards comparable to Indian standards.
7. Security & Safeguards
LayoverX implements reasonable technical, administrative, and physical security measures designed to safeguard personal data against unauthorized access, loss, alteration, disclosure, or destruction.
- Secure data transmission protocols across the Platform using encrypted web connections.
- Restricted internal access controls ensuring that only authorized personnel have access to passenger booking details.
- Strict separation of transactional records, with sensitive payment credentials handled exclusively within certified payment gateway environments.
- Periodic technical assessments, software patch management, and system monitoring to protect platform integrity.
While we implement comprehensive commercial safeguards, no electronic transmission over the internet or cloud storage system can be guaranteed 100% immune from security vulnerabilities. Passengers are advised to safeguard their own devices, accounts, and one-time passwords.
8. Data Retention
Personal data is retained only for as long as reasonably necessary to fulfill the specific operational purposes for which it was collected, including:
- Facilitating and delivering your booked layover experiences and concierge support.
- Maintaining customer accounts, service history, and draft itineraries.
- Complying with statutory financial, tax, and accounting retention requirements under Indian laws.
- Investigating, addressing, or defending legal, regulatory, or consumer disputes.
- Preventing recurring fraud, abuse, or unauthorized system access.
When personal data is no longer required for operational, legal, or regulatory purposes, it is securely deleted, anonymized, or destroyed in accordance with our data governance practices.
10. Children’s Data
The LayoverX platform and booking services are intended for individuals who have reached the age of majority (18 years or older) and possess the legal capacity to enter into binding contracts.
LayoverX does not knowingly permit children under 18 to independently register accounts or execute bookings. Where an itinerary includes a child or minor passenger, the booking must be created and authorized by a parent, legal guardian, or authorized adult traveling companion. LayoverX complies with applicable statutory requirements concerning children’s data under the DPDP Act, 2023.
11. Data Breach & Incident Response
LayoverX maintains an incident management procedure to identify, contain, assess, and remediate any potential personal data security incidents.
In the event of a verified personal data breach that compromises passenger information, LayoverX will take immediate containment steps and issue appropriate notifications to the Data Protection Board of India and affected Data Principals in the form, manner, and timeline mandated by the DPDP Act, 2023 and applicable regulations, as well as to the Indian Computer Emergency Response Team (CERT-In) under the Information Technology Act where required.
12. Grievance Redressal Mechanism
In compliance with the Digital Personal Data Protection Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020, LayoverX has appointed a dedicated Nodal Grievance Officer to address any privacy questions, data requests, or disputes:
Grievance Redressal Desk
Submitting a Privacy Concern or Request:
To submit a data access, correction, erasure, or consent withdrawal request, please send an email to [PRIVACY EMAIL] or [GRIEVANCE EMAIL] detailing:
- Your full name, registered email address, and phone number
- Your LayoverX Booking ID (if your inquiry relates to an active or past booking)
- The specific right you wish to exercise or a clear description of the privacy concern
- Any supporting information necessary to verify your identity as the Data Principal
Statutory Redressal Standards:
• Written grievances are officially acknowledged within forty-eight (48) hours of receipt.
• A formal response and resolution plan will be communicated within thirty (30) days.
If you remain unsatisfied with our grievance resolution, you may have the right under the DPDP framework to escalate the matter to the Data Protection Board of India in accordance with prescribed rules.
13. Policy Updates & Contact
LayoverX reserves the right to revise or update this Privacy Policy periodically to reflect changes in our operational procedures, new transit features, or evolving legal standards under the DPDP framework and Indian data protection rules.
When modifications are made, the revised policy will be posted on this page with an updated “Last Updated” date. We encourage passengers to review this Privacy Policy periodically to stay informed about how their personal data is protected.
For any questions regarding this Privacy Policy or our data protection practices, please contact our team at [PRIVACY EMAIL].